fix: email storage, case number assignment, stale closure, comment validation

- Store submitter_email on post insert (was hardcoded null)
- Assign APM-XXXX case number at approval time when not already set
- Await approval email and return 207 on failure instead of silently swallowing
- Use ref for authedPassword in admin useEffect to avoid stale closure
- Validate that non-anonymous comments include a handle
- Clean up search OR filter construction (typed, readable)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: royalpinto007

app/admin/page.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useState, useEffect, useCallback } from "react";
+import { useState, useEffect, useCallback, useRef } from "react";
 import { Badge } from "@/components/ui/Badge";
 import { Button } from "@/components/ui/Button";
 
@@ -64,6 +64,7 @@ function DamagePip({ level }: { level: number }) {
 export default function AdminPage() {
   const [password, setPassword] = useState("");
   const [authedPassword, setAuthedPassword] = useState("");
+  const authedPasswordRef = useRef("");
   const [authError, setAuthError] = useState("");
   const [authenticated, setAuthenticated] = useState(false);
 
@@ -116,9 +117,9 @@ export default function AdminPage() {
   const [initialAuthDone, setInitialAuthDone] = useState(false);
   useEffect(() => {
     if (authenticated && initialAuthDone) {
-      fetchPosts(tab, authedPassword);
+      fetchPosts(tab, authedPasswordRef.current);
     }
-  }, [tab]); // eslint-disable-line react-hooks/exhaustive-deps
+  }, [tab, authenticated, initialAuthDone, fetchPosts]);
 
   async function handleAuth(e: React.FormEvent) {
     e.preventDefault();
@@ -129,6 +130,7 @@ export default function AdminPage() {
     if (res.ok) {
       const json = await res.json();
       setAuthedPassword(password);
+      authedPasswordRef.current = password;
       setPosts(json.posts ?? []);
       setCounts(json.counts ?? { pending: 0, approved: 0, rejected: 0 });
       setInitialAuthDone(true);

app/api/admin/posts/[id]/route.ts

@@ -31,9 +31,33 @@ export async function PATCH(req: NextRequest, { params }: RouteParams) {
 
   const supabase = createSupabaseAdminClient();
 
+  // Assign case number on approval if not already set
+  let caseNumber: string | null = null;
+  if (parsed.data.status === "approved") {
+    const { data: existing } = await supabase
+      .from("posts")
+      .select("case_number")
+      .eq("id", params.id)
+      .single();
+
+    if (!existing?.case_number) {
+      const { count } = await supabase
+        .from("posts")
+        .select("*", { count: "exact", head: true })
+        .eq("status", "approved");
+      const seq = ((count ?? 0) + 1).toString().padStart(4, "0");
+      caseNumber = `APM-${seq}`;
+    }
+  }
+
+  const updatePayload =
+    caseNumber !== null
+      ? { status: parsed.data.status, case_number: caseNumber }
+      : { status: parsed.data.status };
+
   const { data, error } = await supabase
     .from("posts")
-    .update({ status: parsed.data.status })
+    .update(updatePayload)
     .eq("id", params.id)
     .select("id, status, case_number, submitter_email, title")
     .single();
@@ -48,14 +72,20 @@ export async function PATCH(req: NextRequest, { params }: RouteParams) {
 
   if (parsed.data.status === "approved" && data.submitter_email) {
     const caseUrl = `https://agentpostmortem.com/case/${data.case_number}`;
-    sendApprovalEmail({
-      to: data.submitter_email,
-      caseNumber: data.case_number,
-      caseTitle: data.title,
-      caseUrl,
-    }).catch((err) => {
+    try {
+      await sendApprovalEmail({
+        to: data.submitter_email,
+        caseNumber: data.case_number,
+        caseTitle: data.title,
+        caseUrl,
+      });
+    } catch (err) {
       console.error("[admin/posts/id] approval email failed:", err);
-    });
+      return NextResponse.json(
+        { error: "Post approved but approval email failed to send.", data },
+        { status: 207 },
+      );
+    }
   }
 
   return NextResponse.json(data);

app/api/comments/route.ts

@@ -48,6 +48,16 @@ export async function POST(req: NextRequest) {
       );
     }
 
+    const isAnon = is_anonymous ?? true;
+    const handle =
+      typeof author_handle === "string" ? author_handle.trim() : null;
+    if (!isAnon && !handle) {
+      return NextResponse.json(
+        { error: "A handle is required when posting non-anonymously." },
+        { status: 400 },
+      );
+    }
+
     const ip = getIp(req);
     const ip_hash = hashIp(ip);
 
@@ -70,8 +80,8 @@ export async function POST(req: NextRequest) {
       .insert({
         post_id,
         body: trimmed,
-        is_anonymous: is_anonymous ?? true,
-        author_handle: is_anonymous ? null : (author_handle ?? null),
+        is_anonymous: isAnon,
+        author_handle: isAnon ? null : handle,
         ip_hash,
         status: "visible",
       })

app/api/posts/route.ts

@@ -110,7 +110,7 @@ export async function POST(req: NextRequest) {
         screenshot_urls: data.screenshotUrls ?? [],
         is_anonymous: data.isAnonymous,
         submitter_handle: cleanHandle,
-        submitter_email: null,
+        submitter_email: data.email ?? null,
         edit_token_hash: tokenHash,
         ip_hash: ipHash,
         status: "pending",

lib/db/posts.ts

@@ -224,20 +224,17 @@ export async function fetchSearchPosts(
       .ilike("name", `%${query}%`);
     const agentIds = (agentRows ?? []).map((a) => (a as { id: string }).id);
 
-    let q = supabase
+    const textFilter = `title.ilike.%${query}%,outcome.ilike.%${query}%,case_number.ilike.%${query}%`;
+    const orFilter =
+      agentIds.length > 0
+        ? `${textFilter},agent_id.in.(${agentIds.join(",")})`
+        : textFilter;
+
+    const q = supabase
       .from("posts")
       .select(`*, agents(slug, name, company), post_tags(tags(slug, label))`)
-      .eq("status", "approved");
-
-    if (agentIds.length > 0) {
-      q = q.or(
-        `title.ilike.%${query}%,outcome.ilike.%${query}%,case_number.ilike.%${query}%,agent_id.in.(${agentIds.join(",")})`,
-      );
-    } else {
-      q = q.or(
-        `title.ilike.%${query}%,outcome.ilike.%${query}%,case_number.ilike.%${query}%`,
-      );
-    }
+      .eq("status", "approved")
+      .or(orFilter);
 
     const { data, error } = await q
       .order("vote_score", { ascending: false })